Fix most significant bugs in certificate categories configuration

See individual commits for details. This makes the configuration at least behave mostly as expected, while we decide what to do with the entire feature. The implementation isn't amazing, cleaning it up would require major rewrites to the code that I don't want to do for a feature that might be removed soon.

GnuPG-Bug-ID: 7212